Medicare Program; Medicare Secondary Payer and Certain Civil Money Penalties, 70363-70373 [2023-22282]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 88, Number 195 (Wednesday, October 11, 2023)]
[Rules and Regulations]
[Pages 70363-70373]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-22282]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 402

45 CFR Part 102

[CMS-6061-F]
RIN 0938-AT86


Medicare Program; Medicare Secondary Payer and Certain Civil 
Money Penalties

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule will specify how and when CMS must calculate 
and impose civil money penalties (CMPs) when group health plan (GHP) 
and non-group health plan (NGHP) responsible reporting entities (RREs) 
fail to meet their Medicare Secondary Payer (MSP) reporting obligations 
by failing to register and report as required by MSP reporting 
requirements. This final rule will also establish CMP amounts and 
circumstances under which CMPs will and will not be imposed.

DATES: 
    Effective date: This final rule is effective on December 11, 2023.
    Applicability date: The provisions of this rule are applicable on 
or after October 11, 2024.

FOR FURTHER INFORMATION CONTACT: Brian Broznowicz, (410) 786-3349.

SUPPLEMENTARY INFORMATION:

I. Background

A. Imposition of Civil Money Penalties (CMPs)--Legislative Overview

    In 1981, the Congress added section 1128A to the Social Security 
Act (the Act) (section 2105 of Pub. L. 97-35) to authorize the 
Secretary of Health and Human Services (the Secretary) to impose civil 
money penalties (CMPs) and assessments on certain health care 
facilities, health care practitioners, and other suppliers for 
noncompliance with rules of the Medicare and Medicaid programs. CMPs 
and assessments provide an enforcement tool for agencies to use to 
ensure compliance with statutory and regulatory requirements. These 
CMPs and assessments may be imposed in addition to potential criminal 
or civil penalties.
    Since 1981, the Congress has increased both the number and the 
types of circumstances under which the Secretary may impose CMPs. Some 
CMP authorities address fraud, misrepresentation, or falsification, 
while others address noncompliance with programmatic or regulatory 
requirements. The Secretary has delegated the authority for certain 
provisions to either the Office of Inspector General (OIG) or Centers 
for Medicare & Medicaid Services (CMS). (See the October 20, 1994, 
notice, titled ``Office of Inspector General; Health Care Financing 
Administration; Statement of Organization, Functions, and Delegations 
of Authority'' (58 FR 52967).) A summary of these CMP changes is 
discussed in this section of this final rule.

B. Medicare Secondary Payer History

    In 1980, the Congress added section 1862(b) of the Act, which 
defined when Medicare is the secondary payer to certain primary plans. 
These provisions are known as the Medicare Secondary Payer (MSP) 
provisions of the Act.
    Section 1862(b)(2)(A) of the Act prohibits Medicare from making 
payment if payment has been made, or can reasonably be expected to be 
made by any of the following primary plans:
     Group Health Plans (GHPs).
     Workers' compensation plans.
     Liability insurance (including self-insurance).
     No-fault insurance.
    Medicare may make conditional payments, subject to Medicare payment 
rules, in situations where workers' compensation, liability insurance 
(including self-insurance), or no-fault insurance has not made payment 
or cannot be expected to make payment promptly. Any conditional 
payments that Medicare makes are subject to reimbursement from the 
primary plan. See section 1862(b)(2)(B) of the Act.

C. Legislative Provisions Regarding Mandatory Reporting Requirements

    To enhance enforcement of the MSP provisions, section 111 of the 
Medicare, Medicaid, and SCHIP Extension Act of 2007 (MMSEA) (Pub. L. 
110-173) added paragraphs (7) and (8) to section 1862(b) of the Act. 
These paragraphs established new mandatory reporting requirements 
regarding Medicare beneficiaries who have coverage under GHP 
arrangements, as well as when liability insurance (including self-
insurance), no-fault insurance, or workers' compensation (collectively 
referred to as Non-Group Health Plans, or NGHPs) provide settlements, 
judgments, awards, or assume other payment responsibility for Medicare 
beneficiaries' care. Sections 1862(b)(7)(A) and (b)(8)(F) of the Act 
define those parties responsible for this

[[Page 70364]]

reporting (collectively referred to as responsible reporting entities, 
or RREs). Under section 1862(b)(7)(A) of the Act, GHPs or third-party 
administrators are obligated to report beneficiary coverage; almost 
1,000 entities are registered as GHP RREs, with 62 percent estimating 
between 1,000 and 100,000 individual beneficiaries to be reported 
annually. Under section 1862(b)(8)(F) of the Act, NGHP applicable plans 
are obligated to report settlements or when the entity otherwise 
assumes payment responsibility, and over 21,000 entities are registered 
as NGHP RREs, with the vast majority (88.29 percent) estimating fewer 
than 500 individual beneficiaries to report annually at the time of 
registration.
    RREs are currently required to submit coverage information for 
Medicare beneficiaries including, but not limited to, when coverage 
begins or ends, or when a judgment, award, settlement, or other payment 
is made, on a quarterly basis through an electronic file submission 
process that may vary depending upon the number of beneficiary records 
being reported or updated. NGHP RREs who submit 500 or less claim 
reports per year are eligible to utilize the Coordination of Benefits 
Secure website (COBSW) Direct Data Entry (DDE) reporting option to add, 
update, or delete claim information. DDE submitters have the same 
responsibility and accountability as any other RRE. This coverage 
information primarily consists of enough identifying information to 
uniquely identify the Medicare beneficiary and confirm their 
beneficiary status, as well as information about the nature of the 
coverage (such as GHP or NGHP, coverage effective dates, policy limits, 
settlement amounts, and so forth). These section 111 of MMSEA reporting 
provisions did not alter any other existing statutory provisions or 
regulations. Further, these reporting provisions include authority for 
CMS to impose CMPs against entities that fail to comply with the 
section 111 of MMSEA reporting requirements under section 1862(b)(7) or 
(b)(8) of the Act, as amended by the Medicare IVIG Access and 
Strengthening Medicare and Repaying Taxpayers Act of 2012 (the SMART 
Act). These provisions also require that GHPs and NGHPs that fail to 
comply with these reporting requirements shall be subject to a CMP of 
$1,000 and up to $1,000, respectively, for each calendar day of 
noncompliance. Imposition of penalties related to noncompliance with 
section 111 of MMSEA are required to be promulgated in regulation, 
which is the purpose of this rule.
    In 2013, Congress enacted the SMART Act, which amended section 
1862(b)(8)(E) of the Act, which includes the section 111 of MMSEA 
reporting requirements and describes the enforcement provisions for 
NGHPs that fail to comply with the reporting requirements. 
Specifically, the SMART Act revised section 1862(b)(8)(E) of the Act to 
state that NGHP applicable plans that fail to comply with the reporting 
requirements may be subject to a civil money penalty of up to $1,000 
for each calendar day of reporting noncompliance required of NGHP 
applicable plans under section 1862(b)(8)(E) of the Act. The SMART Act 
also added section 1862(b)(8)(I) of the Act, which specifically 
required rulemaking actions regarding the enforcement of CMP provisions 
under section 1862(b)(8)(E) of the Act.
    We note that the SMART Act did not amend any CMP provisions for GHP 
arrangements that have reporting obligations under section 1862(b)(7) 
of the Act. Such GHP arrangements remain subject to mandatory CMPs of 
$1,000 per calendar day of noncompliance and per individual for whom 
submission of information was required. In addition, the SMART Act 
directed rulemaking for NGHP applicable plans regarding the imposition 
and non-imposition of CMPs.
    We further note that the statutory language speaks to 
``individuals,'' though there are situations described that are 
specifically applicable to Medicare beneficiaries; we have attempted to 
be consistent with the usage of this statutory terminology but use the 
term ``beneficiary'' where it is more appropriate.

D. Summary of Public Comments Received on the December 11, 2013, 
Advance Notice of Proposed Rulemaking (ANPRM)

    As the mandatory insurer reporting requirements themselves are 
self-implementing, we were able to gradually implement the reporting 
process from 2009 through 2011. The implemented reporting process 
included informal communications to RREs regarding their compliance 
with reporting requirements, including ``compliance flags'' in response 
to records that fail to meet specified criteria and even direct 
outreach to RREs. However, the implementation of civil money penalties 
for noncompliance requires formal rulemaking. In accordance with the 
rulemaking directed by the SMART Act, on December 11, 2013 (78 FR 
75304), we published an advance notice of proposed rulemaking (ANPRM) 
titled ``Medicare Secondary Payer and Certain Civil Money Penalties.'' 
The December 2013 ANPRM solicited public comment on specific practices 
for which CMPs may or may not be imposed for failure to comply with MSP 
reporting requirements for certain GHP and NGHP arrangements.
    We received 34 timely pieces of correspondence in response to the 
December 2013 ANPRM. In section I.D. of the February 18, 2020, proposed 
rule, we provided an analysis of the public comments received by 
subject area, with a focus on the most common issues raised, and 
briefly discuss how we proposed to address the issues raised by 
commenters in response to the 2013 ANPRM. Commenters expressed many of 
the same concerns and raised most of the same points that were raised 
in response to the proposed rule, published on February 18, 2020. While 
the proposed rule addressed these comments, alterations to the rule, as 
well as an evolving stakeholder landscape, resulted in many comments to 
the proposed rule being resubmitted in substantially similar form and 
content. Specifically, many commenters requested clarity around how a 
CMP would be calculated, the possibility of a sliding scale or tiered 
approach to levying CMPs, establishing a statute of limitations, and 
confirming that enforcement of the rule would be prospective only. For 
more detailed information on our analysis of the public comments on the 
ANPRM, please see the February 18, 2020, proposed rule (85 FR 8795 
through 8797).

II. Provisions of the Proposed Rule and the Analysis of and Responses 
to Public Comments

    In the February 18, 2020, Federal Register (85 FR 8793), we 
published the proposed rule titled ``Medicare Secondary Payer and 
Certain Civil Money Penalties.'' In drafting the February 2020 proposed 
rule, we reviewed the public comments in response to our December 11, 
2013, ANPRM (78 FR 75304), and other policy considerations. 
Accordingly, we proposed specific criteria for when CMPs would be 
imposed and proposed specific criteria for when CMPs would not be 
imposed, in circumstances when a GHP or an NGHP entity fails to comply 
(either on its own or through a reporting agent) with MSP reporting 
requirements specified under section 1862(b)(7) and (b)(8) of the Act. 
Further, we proposed to amend the amount of these CMPs, as set forth 
under 45 CFR 102.3 (Penalty adjustment and table).

[[Page 70365]]

    We received 47 timely pieces of public correspondence on the 
February 18, 2020, proposed rule. Commenters included various group 
health plans and private insurance companies (non-group health plan 
insurers) as well as their representatives, special interest groups, 
and other interested individuals. Some comments addressed issues or 
expressed concerns that were outside the scope of this rule and were 
thus inappropriate to address in this venue. Of the remaining comments, 
there were many that expressed concern with various aspects of the 
proposed rule including the possible amount of CMPs, the process by 
which noncompliance would be discovered, and the proportionality of the 
possible penalties when compared to the severity of the noncompliance 
as well as the relative size of the entity against which a penalty was 
contemplated. In direct response to public comment, as well as 
substantial internal data analysis, CMS has revised the final rule to 
be responsive to the concerns of those entities that may be impacted by 
the rule.

A. CMP Basis and Scope in the Proposed Rule

    The existing regulation at 42 CFR 402.1 describes the basis for 
imposition of CMPs against parties who violate the provisions of the 
Act. We proposed to add regulatory language under Sec.  402.1(c), which 
would identify situations in which GHP and NGHP RREs would be subject 
to CMPs under sections 1862(b)(7) and (b)(8) of the Act. To accomplish 
this regulatory addition, we proposed the following regulatory 
revisions in Sec.  402.1:
     Removing paragraph (c)(20), which currently refers to a 
provision that is no longer applicable regarding the imposition of CMPs 
for employers that fail to timely, and accurately report an employee's 
group health insurance coverage.
     Redesignating paragraph (c)(21) as paragraph (c)(20).
     Redesignating paragraphs (c)(22) through (34) as 
paragraphs (c)(23) through (35).
     Adding new paragraphs (c)(21) and (22), which will 
incorporate the new text finalized in this rule and all applicable 
provisions.
    The existing regulation at 42 CFR 402.105(b) establishes the 
amounts of penalties assessed against parties who violate the 
provisions of the Act. We proposed to amend Sec.  402.105(b) by 
revising paragraph (b)(2) and adding a new paragraph (b)(3). The 
proposed regulation at Sec.  402.105(b)(2) would codify the amounts of 
penalties imposed against GHPs, and the proposed regulation at Sec.  
402.105(b)(3) would establish the amounts of penalties imposed against 
NGHPs.
    In addition, we proposed to revise the regulations at 45 CFR 102.3 
to establish the updated amounts for all CMPs at issue in these 
regulations.
    Comment: Some commenters expressed concerns about the potential 
size of the CMPs that would be imposed and recommended developing a 
``sliding scale'' or ``tiered'' CMP approach. These suggestions 
included scaling the amount of the CMP to be imposed based upon the 
intentions of the noncompliant entity, or upon whether an excess 
proportion of individual beneficiary records failed to be reported as 
required (in essence creating a safe harbor for a certain portion of 
records to not be reported as required), and other similar 
recommendations to limit the size of the CMP. Some commenters also 
noted the statutory discrepancy between the penalty amounts for GHP, 
which are $1,000 per day of noncompliance, and NGHP entities, which are 
up to $1,000 per day of noncompliance.
    Response: We begin by noting that CMS does not have the authority 
to alter penalties for GHPs, as penalty amounts are stated in section 
1862(b)(7) of the Act. In the proposed rule, we proposed that penalties 
for NGHP entities would parallel those for GHP entities. However, 
because CMS has the authority to adjust CMPs for NGHP entities, we are 
instead finalizing a tiered approach with respect to such entities, 
under which we will adjust penalty amounts based on the length of time 
that a report has been untimely. The full explanation of this approach 
appears in the next section of this document.
    While ultimately the responsibility of the RRE, CMS is not 
unsympathetic to RREs in regard to those situations where a particular 
late submission was the result of a rare situation, system glitch, 
defect, or other problem that was unanticipated or out of the immediate 
control of the RRE. For this reason, an informal notice process will be 
implemented so that any RRE that receives notice that a CMP is pending 
against them will have an opportunity to examine their records and 
alert CMS to any discrepancies or mistakes that could mitigate or 
eliminate the potential penalty. This process is described in full 
detail later in this document.
    Comment: Some commenters alleged that the amount of CMPs, in 
certain circumstances, are too high, excessive, disproportionate to the 
harm to the program, or unconstitutional.
    Response: The amounts of the GHP CMPs are set by statute, in 
accordance with section 1862(b)(7)(B) of the Act, and CMS must enforce 
the amount as set by statute. While CMS has discretion to adjust CMPs 
for NGHPs under section 1862(b)(8)(E) of the Act, the statute does not 
authorize such discretion with respect to GHPs. In the proposed rule, 
we proposed that CMPs imposed against NGHPs would be aligned with those 
for GHP entities. However pursuant to this final rule, penalties for 
NGHP entities will instead be tiered based on the amount of time that a 
record has been late, or gone unreported, in accordance with the 
language of the statute which provides that penalties for NGHPs are up 
to $1,000 per day of noncompliance.
    We originally proposed that CMPs may be levied in addition to any 
MSP reimbursement obligations identified using the reported 
information, but that CMS would not impose duplicative penalties. For 
example, failure to timely report the termination of coverage and then 
submitting the late termination in a manner that exceeds the error 
tolerance threshold for the fourth time in eight consecutive reporting 
periods, may meet the criteria for two potential CMPs with the 
submission of one record. However, we proposed that CMS would only 
impose a CMP once, and for the lesser of the two potential CMPs. This 
proposed limitation has been eliminated in the final rule as a result 
of being rendered unnecessary by the new audit methodology that will be 
employed.

B. CMP Imposition and Amounts in the Proposed Rule

    The proposed regulations at Sec.  402.1(c) identified circumstances 
where GHP and NGHP entities would be subject to CMPs for violation of 
sections 1862(b)(7) and (b)(8) of the Act. Following publication of the 
final rule, we intended to enhance monitoring of recovery process 
disputes and appeals that contradict reported data, as well as 
monitoring the reported data and performance over time to identify 
reporting that exceeded error tolerances. The proposed regulations at 
Sec.  402.105(b) explained how we would calculate CMP amounts for GHP 
and NGHP entities that have reporting obligations under sections 
1862(b)(7) and (b)(8) of the Act. Furthermore, proposed Sec.  402.1(c) 
identified situations where GHP and NGHP RREs would not be subject to 
CMPs for violation of sections 1862(b)(7) and (b)(8) of the Act. The 
final rule will limit CMPs to only instances of noncompliance based on 
timely reporting, so as to greatly simplify the process by which CMPs 
are

[[Page 70366]]

levied. The changes to the final rule are largely in response to 
stakeholder concerns raised in response to the ANPRM and proposed rule 
that alleged that the proposed process was confusing, punitive, and 
failed to serve the intended purpose of encouraging compliance and 
fostering collaboration with CMS. More information on this will be in 
the following section.
    Under section 1862(b)(7) of the Act, a GHP RRE shall be subject to 
a CMP of $1,000 as adjusted annually under 45 CFR part 102 (currently 
$1,325 as of June 8, 2023; see 87 FR 15101)) for each calendar day of 
noncompliance for each individual for which the required information 
should have been submitted. Under section 1862(b)(8) of the Act, an 
NGHP RRE may be subject to a CMP of up to $1,000 as adjusted annually 
under 45 CFR part 102 (currently $1,325 as of June 8, 2023; see 87 FR 
15101) for each calendar day of noncompliance with respect to each 
claimant. These CMPs would be in addition to any other penalties 
prescribed by law, and in addition to any MSP claim under section 
1862(b) of the Act with respect to an individual.
1. Imposition of a CMP
    In the proposed rule, CMS indicated that a penalty would be imposed 
if an RRE fails to report or update any GHP beneficiary record within 
the required timeframe (no more than 1 calendar year after GHP coverage 
effective date or the Medicare beneficiary's entitlement date, 
whichever is later). In the proposed rule, CMS proposed that the 
penalty be calculated on a daily basis, based on the actual number of 
individual beneficiaries' records that the entity submitted untimely 
(that is, beyond the required timeframe after the GHP MSP effective 
date). CMS proposed that the penalty be $1,000 (as adjusted annually 
under 45 CFR part 102) for each calendar day of noncompliance for each 
individual for which the required information should have been 
submitted, as counted from the day after the last day of the RRE's 
assigned reporting window where the information should have been 
submitted through the day that CMS received the information, up to a 
maximum penalty of $365,000 (as adjusted annually under 45 CFR part 
102) per individual per year.
    In the proposed rule, CMS also proposed a penalty if an RRE failed 
to report any NGHP beneficiary record within the required timeframe of 
no more than 1 year after the date of the settlement, judgment, award, 
or other payment (also referred to as the Total Payment Obligation to 
Claimant (TPOC)). CMS proposed that the penalty be calculated on a 
daily basis, based on the actual number of individual beneficiaries' 
records that the entity submitted untimely (that is, in excess of the 
required timeframe after the TPOC date). In the proposed rule, CMS 
proposed that the penalty be up to $1,000 (as adjusted annually under 
45 CFR part 102) for each calendar day of noncompliance for each 
individual for which the required information should have been 
submitted, as counted from the day after the last day of the RRE's 
assigned reporting window where the information should have been 
submitted through the day that CMS received the information, up to a 
maximum penalty of $365,000 (as adjusted annually under 45 CFR part 
102) per individual per year.
    In the proposed rule, CMS also proposed that a CMP be assessed if a 
GHP's or NGHP's response to CMS recovery efforts contradicted the 
entity's section 111 of MMSEA reporting. For example, if an RRE 
reported and repeatedly affirmed ongoing primary payment responsibility 
for a given beneficiary, then responded to recovery efforts with the 
assertion that coverage for that beneficiary actually terminated 2 
years prior to the issuance of the recovery demand letter. The penalty 
as proposed would have been calculated based on the number of calendar 
days that the entity failed to appropriately report updates to 
beneficiary records, as required for accurate and timely reporting 
under section 111 of MMSEA. In the proposed rule, for a GHP, CMS 
proposed that the penalty be $1,000 (as adjusted annually under 45 CFR 
part 102) for each calendar day of noncompliance for each individual 
for which the required information should have been submitted. For an 
NGHP, CMS proposed that the penalty be up to $1,000 (as adjusted 
annually under 45 CFR part 102) per calendar day of noncompliance for 
each individual, for a maximum annual penalty of $365,000 (as adjusted 
annually under 45 CFR part 102) for each individual for which the 
required information should have been submitted.
    In the proposed rule, CMS also proposed that a penalty be assessed 
if a GHP or NGHP entity had reported and exceeded any error 
tolerance(s) threshold established by the Secretary in any 4 out of 8 
consecutive reporting periods (as defined later in this section). We 
proposed that the initial and maximum error tolerance threshold would 
be 20 percent (representing errors that prevent 20 percent or more of 
the beneficiary records from being processed), with any reduction in 
that tolerance to be published for notice and comment in advance of 
implementation. We proposed that this tolerance would be applied as an 
absolute percentage of the records submitted in a given reporting 
cycle.
    In this final rule, all other proposed avenues for receiving a CMP 
have been eliminated and the only method of noncompliance that would be 
ripe for a CMP would be untimely reporting, as fully explained in the 
following section.
    Comment: Many commenters emphasized that this rule should not be 
aimed at those exhibiting ``good faith efforts'' or those who make an 
earnest attempt at reporting but may do so occasionally with error but 
instead be aimed at those who fail to report at all.
    Response: It is not our intent to penalize RREs for honest, 
infrequent mistakes, but instead to only resort to penalty when an RRE 
fails to report or submits reports in an untimely manner. We 
acknowledge that the overwhelming majority of RREs report correctly and 
timely a majority of the time and commend those entities for working 
with CMS to provide accurate data. It is, therefore, CMS's shared 
opinion with commenters that the focus shall not be to punish and 
impose consequences but instead to motivate proper reporting and 
maintain compliance with existing statute and regulation. To that end, 
CMS is adopting an audit approach in this final rule whereby we will 
audit a randomized sample of new beneficiary records received each 
quarter, rather than undertaking an automated review of all records 
submitted, as proposed. By using this random auditing approach, CMS 
will be better able to monitor trends in reporting, via manual review 
of said records, rather than a mass, computer-based algorithm, which 
will allow us to discover areas that appear to be more of a challenge 
for RREs without resorting to penalties that may be disproportionate to 
the level of noncompliance exhibited or have the effect of penalizing 
an entity for an honest mistake or system error. RREs will also be able 
to avail themselves of the informal notice and dispute process to alert 
CMS to their ``good faith efforts'' to report any records that CMS has 
identified as being out of compliance.
    Comment: Some commenters raised concerns about the imposition of 
CMPs related to the reporting of Ongoing Responsibility for Medicals, 
(ORM). Specifically, these commenters cited difficulty with proper and 
timely reporting and understanding how to report ORM termination 
correctly.
    Response: In the proposed rule, CMS proposed imposing penalties for 
failing to accurately and timely report ORM

[[Page 70367]]

acceptance or termination. In the final rule, based on stakeholder 
concerns and submitted comments, CMS has chosen to focus its definition 
of noncompliance solely on those situations where an entity has failed 
to provide its initial report of primary payment responsibility in a 
timely manner. That means that untimely termination of ORM coverage 
records would not be considered eligible for a civil money penalty 
under this rule. While not a part of this final rule, we also note that 
CMS strives to engage with stakeholders, including RREs, about the 
reporting process and continuous process improvement efforts 
particularly as they relate to ORM, and will continue to do so in the 
future. We invite any RREs with concerns about ORM or any other aspect 
of reporting to proactively use the available outreach and education 
tools to address their questions.
    We also wish to convey that time delays caused by CMS or its 
contractors in the reporting process will not trigger penalties related 
to timeliness. RREs must adhere to all applicable timelines, but any 
delay encountered when following CMS's policies and procedures will not 
be held against the RRE (for example, time delays related to processing 
by CMS contractors will not trigger any penalty).
    Comment: A number of commenters suggested that CMS should develop a 
formal appeal process to provide entities with reporting obligations a 
formal structure in which to appeal any notice of a pending or imposed 
CMP.
    Response: We note that CMPs imposed in accordance with this final 
rule will be subject to the formal appeals process as prescribed by 42 
CFR 402.19 and set forth under 42 CFR part 1005. In broad terms, 
parties subject to CMPs will receive formal written notice at the time 
penalty is proposed. The recipient will have the right to request a 
hearing with an Administrative Law Judge (ALJ) within 60 calendar days 
of receipt. Any party may appeal the initial decision of the ALJ to the 
Departmental Appeals Board (DAB) within 30 calendar days. The DAB's 
decision becomes binding 60 calendar days following service of the 
DAB's decision, absent petition for judicial review.
    Comment: Some commenters stressed the possibility of delays and 
uncertainty regarding their appeals due to backlogs at various stages 
of the administrative appeals process, and some suggested that CMS 
utilize a different appeals process.
    Response: We affirm that CMS is bound by the appeal process as 
prescribed in 42 CFR 402.19 and set forth under 42 CFR part 1005.
    Comment: Many commenters requested that CMS explain how it will 
provide notice to entities regarding pending or imposed CMPs and how 
much information will be included.
    Response: We intend to communicate with the entity informally 
before issuing formal notice regarding a CMP. The informal (that is, 
prior to formal enforcement actions) written ``pre-notice'' process 
will allow the RRE the opportunity to present mitigating evidence for 
CMS review prior to the imposition of a CMP. The RRE will have 30 
calendar days to respond with mitigating information before the 
issuance of a formal written notice in accordance with 42 CFR 402.7.
    Common to all such instances where informal notice will be given is 
the intention to give the RRE an opportunity to clarify, mitigate, or 
explain any errors that were the result of a technical issue or due to 
an error or system issue caused by CMS or its contractors. It would be 
impractical and counter to the spirit of the informal notice process to 
regulate or enumerate all circumstances in which mitigating information 
could be provided or what that information should convey. As such, any 
mitigating factors or circumstances are welcomed, and a dialogue is 
encouraged in an attempt to find solutions that are short of imposing a 
CMP. We believe it is in the best interests of all RREs to leave the 
informal notice process open to any reasonable submission of mitigating 
factors so that we are free to entertain all such documentation without 
strict limits on what is, or is not, acceptable.
    Once we determine that a CMP will be imposed (after the informal 
notice period) we will provide formal notice to the entity in writing 
in accordance with 42 CFR 402.7, which will contain information on the 
event that has triggered the proposed imposition of a CMP, the amount 
of the proposed CMP, and next steps for the entity, including a right 
to a hearing in accordance with 42 CFR 402.19 and part 1005.
    Comment: Commenters suggested that CMS should not impose CMPs in 
situations where required information has already been reported to 
another agency or entity, such as the Department of Labor, or in 
situations where multiple entities have obligations to report the same 
information to CMS and one entity has already reported.
    Response: Sections 1862(b)(7) and (b)(8) of the Act imposed certain 
unique requirements on specific entities to report data to CMS for the 
purposes of identifying those situations where another party has 
primary payment responsibility. These reporting requirements were 
imposed under the Act, regardless of whether another agency or entity 
requires the same or similar data (and such data must also be reported 
to CMS in the manner and form specified by the Secretary). The current 
Office of Management and Budget (OMB) control number assigned to this 
information collection effort, as required under the Paperwork 
Reduction Act, is 0938-1074.
    Commenters provided examples of data submitted to other agencies 
that they believe are similar, but the data are not used for a 
comparable purpose to the data that is reported to CMS. Consequently, 
this data is neither in the same format that CMS systems require, nor 
is it the complete set of data that CMS needs for the proper 
coordination of benefits. Therefore, any attempt to create a data-
sharing agreement that would render reporting to CMS truly duplicative 
would require that other agencies update their data collection efforts 
to align with CMS, despite the fact that those agencies may have no 
need for that data. Not only would that impose additional costs to the 
federal government to accommodate a relatively small number of 
entities, it would also undermine efforts under this rule to verify the 
accuracy or timeliness of the reporting. Therefore, it is impractical 
to attempt to promulgate such data sharing agreements and all RREs must 
continue to perform reporting as required by the Act.
    Comment: Commenters suggested that CMS not impose CMPs when CMS has 
been able to coordinate benefits correctly or CMS has otherwise been 
able to recover any conditional payments made due to untimely or 
inaccurate reporting.
    Response: The obligations to report under sections 1862(b)(7) and 
(b)(8) of the Act are separate and distinct from any other obligation 
with respect to MSP, including reimbursement. Providing accurate 
information in response to recovery efforts does not satisfy those 
obligations and the fact that we may be able to eventually correctly 
coordinate benefits and retain the right to pursue recovery does not 
negate the reporting obligations established under sections 1862(b)(7) 
and (b)(8) of the Act.
    Comment: Most commenters requested a statute of limitations on the 
imposition of CMPs.
    Response: We agree and will apply the 5-year statute of limitations 
as required by 28 U.S.C. 2462. Under 28 U.S.C. 2462, we may only impose 
a CMP within 5 years from the date when the noncompliance occurred.

[[Page 70368]]

    Comment: Many commenters suggested that the statute of limitations 
should be 3 years.
    Response: Under 28 U.S.C. 2462, the applicable statute of 
limitations is 5 years. Although section 1862(b)(2)(B)(iii) of the Act 
establishes a 3-year statute of limitations for certain actions, that 
provision applies only to legal actions CMS may utilize for the 
recovery of MSP debts. While recovery of conditional payments 
(overpayments) and the imposition of CMPs may appear, on their face, to 
be similar actions, they are unique and serve separate, distinct 
purposes and the statute of limitations applicable to the former does 
not also apply to the latter. An explanation and example of how this 5-
year statute of limitations will apply is as follows: For failure to 
initially report the date of settlement or effective date of coverage 
timely (where applicable), noncompliance occurs on every day of non-
reporting after the required timeframe for reporting has elapsed. For 
example, if the date of settlement is January 1, 2025, then the RRE 
will have 1 year from that date to report the coverage before being 
potentially subject to a CMP (that is, January 1, 2026). If the 
settlement date was January 1, 2025, but the RRE did not report it to 
CMS until October 15, 2026, the RRE will be considered noncompliant for 
the period of January 2, 2026, through October 15, 2026. If CMS does 
not act until after October 15, 2031, then the statute of limitations 
has elapsed and no CMP may be imposed.
    Comment: Many commenters suggested that the rule should be enforced 
prospectively only.
    Response: We concur and will evaluate compliance based only upon 
files submitted by the RRE on or after the effective date of the final 
rule. CMPs will only be imposed on instances of noncompliance based on 
those settlement dates, coverage effective dates, or other operative 
dates that occur after the effective date of this regulation and as 
such, there will be no instances of inadvertent or de facto 
retroactivity of CMPs. The 1-year period to report the required 
information before CMPs would potentially be imposed would begin on the 
latter of the rule effective date or the settlement or coverage 
effective dates which an RRE is required to report in accordance with 
sections 1862(b)(7) and (b)(8) of the Act.
    Comment: Commenters suggested that CMS refrain from imposing CMPs 
where NGHPs with reporting obligations under section 1862(b)(8) of the 
Act make ``good faith efforts'' to obtain required information from 
individuals who are unwilling or unable to provide it. Some ``good 
faith efforts'' suggested included the following: (1) CMS could accept 
documentation signed by the individual stating that he or she is either 
not a Medicare beneficiary, or will not provide the NGHP entity with 
his or her Social Security Number (SSN) (full SSN or last 5 digits); 
and (2) CMS could accept a judicial order establishing that the 
individual is not required to provide his or her Medicare Beneficiary 
Identifier (MBI) or SSN to the NGHP entity.
    Response: We note that concerns about ``good faith efforts'' were 
received from the NGHP industry and not the GHP industry during both 
rounds of comments, which we believe is reflective of the fundamental 
differences between the two industries and the relationships between 
those plans and the individuals in question. Our understanding is that 
NGHP applicable plans may at times be in an adversarial relationship 
with the reportable individual, whereas the reportable individual is 
typically the client of a GHP. To this end we understand the concern 
regarding privacy law or consumer protection statute violations, as 
were mentioned by some commenters.
    In response to these comments, we stress that CMPs will not be 
imposed against NGHP entities where those entities have made good faith 
efforts, as outlined in this final rule, to obtain necessary reporting 
information. NGHP entities must document their efforts to obtain this 
reporting information and retain this documentation, as we retain the 
right to audit such documentation. In response to comments, we are 
finalizing a revised version of our proposal regarding how NGHPs may 
avoid being subject to CMPs where they have made sufficient efforts to 
obtain the necessary information. The revisions we are finalizing 
address commenter concerns regarding the type and number of 
communication attempts an RRE must perform, as well as documentation of 
express refusal by an individual or their attorney or representative to 
provide the requested information as a way to satisfy the obligation to 
attempt to collect that information.
    Comment: Many commenters continued to suggest that CMS should 
specify a series of ``safe harbors'' that would preclude the assessment 
of a CMP.
    Response: In this section, we outline two such safe harbors but 
acknowledge that other situations may exist where it is inappropriate 
to penalize an entity for noncompliance. We welcome RREs to use the 
informal or formal appeal process if there are other situations that 
the RRE believes makes it inappropriate to receive a CMP.
    First, any untimely reporting that is the result of a technical or 
system issue outside of the control of the RRE, or that is the result 
of an error caused by CMS or one of its contractors would not be 
considered noncompliance for purposes of this rule. See a more thorough 
explanation in ``Amount of CMPs''.
    Second, any untimely reporting by an NGHP that is the result of a 
failure to acquire all necessary reporting information due to a lack of 
cooperation by the beneficiary will not lead to a CMP provided that 
certain standards are met. This situation is addressed in greater 
detail in section III.D. of this final rule and Sec.  
402.1(c)(22)(ii)(A) as finalized.
    Comment: Commenters suggested that CMS consider suspending the 
imposition of CMPs where changes to mandatory reporting procedures 
require RREs to make significant revisions to the systems used to 
prepare the data for reporting.
    Response: We will continue to provide a minimum of 6 months' (180 
calendar days) notice prior to any changes in procedure, including 
systems alterations or changes to the required data elements, 
associated with section 111 of MMSEA required reporting to allow 
reporting entities adequate time to react. We will not assess any CMPs 
associated with a specific change for a minimum of 2 reporting periods 
following the implementation (effective date) of that policy or 
procedural change. As provided in Sec.  402.1(c)(21)(ii)(A) and 
(c)(22)(ii)(C) as finalized, in the event we are unable to provide a 
minimum of 6 months' notice prior to implementing any reporting process 
changes (such as the addition of a new required data element), we will 
not impose any CMPs associated with that specific reporting process 
change for a minimum of 1 year after that change becomes effective. 
CMPs associated with any unchanged aspects of reporting may still be 
imposed during this time.
2. Overall Response to Comments
    We solicited comments on our proposed approaches to imposing and 
not imposing CMPs, including our proposed methods of calculating CMP 
amounts. Our proposed approach to imposing CMPs was developed with the 
intention of giving entities meaningful opportunities to resolve most 
reporting issues, without the immediate risk that a CMP would be 
imposed. After consideration of the public comments we received, we 
have made a number of important revisions in this final rule.

[[Page 70369]]

    As described in the proposed rule and earlier in this final rule, 
the amount of CMPs for GHPs is established in section 1862(b)(7)(B) of 
the Act, and, except for those situations and criteria described in 
this final rule, CMS does not have the authority to adjust the amount 
of the CMP levied on a GHP entity. In the case of NGHPs, where CMS is 
permitted discretion in the amount of the CMP, we are finalizing a 
tiered approach based upon the length of time for which a submission 
was untimely to better align the penalty to the severity of the 
noncompliance. In the case of GHPs, the statutory language at section 
1862(b)(7)(B) of the Act does not allow this level of discretion, and 
CMS is therefore unable to adjust the amount of GHP-related CMPs.
    The submission of information or documentation that serves to 
mitigate the noncompliance, or explain a technical error, will be 
considered on a case-by-case basis in an effort to prevent the 
imposition of a CMP at all.
    Based on the comments we received, we have determined that we will 
only impose penalties where the initial report was not received in a 
timely manner. Penalties will not be imposed on any other basis, such 
as in relation to the quality of reporting. Timeliness is determined by 
comparing the date a record is submitted and accepted against the date 
CMS should have received the record. The date CMS should receive a 
record is determined by the effective date of coverage or the date of 
settlement (or settlement funding date if the funding of the settlement 
is delayed) plus 1 year (365 days). For every day a record is submitted 
that is past the date that CMS should have received the information, a 
penalty of up to $1,000 per day for NGHP RREs or $1,000 per day, in the 
case of GHP RREs, will be imposed.
    No CMP will be imposed until at least 1 year (365 days) after the 
later of: (1) the applicability date of this final rule; or (2) the 
coverage effective date, or settlement date, an RRE is required to 
report. This is a minor change from the proposed rule which seeks to 
clarify that RREs will have at least 1 year from the rule applicability 
date before any CMP is contemplated. The date that information was 
submitted by the RRE will determine timeliness. Any delay that is the 
result of technical or administrative issues on the part of CMS or its 
contractors will not be held against the RRE for purposes of 
calculating whether reporting was timely.
    In the proposed rule, we proposed that we would not impose a CMP in 
the following situations, where all of the applicable conditions are 
met:
     If an RRE reports any GHP beneficiary record that is 
reported on a quarterly submission timeframe within the required 
timeframe (not to exceed 1 year after the GHP effective date), or any 
NGHP beneficiary record that is submitted within the required timeframe 
(not to exceed 1 year after the settlement date or ORM effective date).
     If an RRE complies with any settlement reporting 
thresholds or any other reporting exclusions published in CMS's MMSEA 
Section 111 User Guides or otherwise established by CMS. Note that 
these thresholds are not defined in the regulatory text as they include 
operational thresholds that are currently subject to change on an 
annual basis per section 1862(b)(9)(B) of the Act as well as other 
operational thresholds for reporting that CMS elects to impose, such as 
the current $5,000 threshold for Health Reimbursement Arrangements, 
which are communicated to RREs through the MMSEA Section 111 User 
Guides. Our ability to implement such thresholds and operational 
exclusions, whether as statutorily mandated or to be responsive to 
stakeholder or litigation needs, is not altered by this regulation.
     If an NGHP entity fails to report timely because the NGHP 
entity was unable to obtain information necessary for reporting from 
the reportable individual, including an individual's last name, first 
name, date of birth, gender, MBI, or SSN (or the last 5 digits of the 
SSN), and the responsible applicable plan has made and maintained 
records of its good faith effort to obtain this information by taking 
all of the following steps:
    ++ The NGHP has communicated the need for this information to the 
individual and his or her attorney or other representative (if 
applicable) and requested the information from the individual and his 
or her attorney or other representative at least twice by mail and at 
least once by phone or other means of contact such as electronic mail 
in the absence of a response to the mailings.
    ++ The NGHP certifies that it has not received a response, or has 
received a response in writing that the individual will not provide his 
or her MBI or SSN (or last 5 digits of his or her SSN).
    ++ The NGHP has documented its efforts to obtain the missing 
information, such as the MBI or SSN (or the last 5 digits of the SSN) 
and the reason for the failure to collect this information.
    The NGHP entity should maintain records of these good faith efforts 
(such as dates and types of communications with the individual) in 
order to be produced as mitigating evidence should CMS contemplate the 
imposition of a CMP. Such records must be maintained for a period of 5 
years. The current OMB control number assigned to this information 
collection effort, as required under the Paperwork Reduction Act, is 
0938-1074.

III. Provisions of the Final Regulations

    The final rule incorporates some of the provisions of the proposed 
rule and also revises some of the provisions as proposed. Additionally, 
the final rule clarifies how the identification of noncompliance will 
occur, which was not discussed in the proposed rule. Those provisions 
of this final rule that differ from the proposed rule are as follows:

A. Removal of Any Basis Other Than Timeliness as a Reason for Imposing 
a CMP

    The only basis for the imposition of a CMP will be untimely 
reporting of required information. The final rule removes all 
references in the proposed rule to ``contradictory reporting'' or 
``exceeding error tolerance'' as a reason to impose a CMP. 
Specifically, any references to an applicable plan providing 
contradictory reporting, and any CMPs imposed as a result, that were 
proposed in 42 CFR 402.1(c)(21) and (c)(22), 402.105(b)(2) and (b)(3), 
or elsewhere, are removed and are not being finalized. As such, the 
following sections of the proposed regulations text have been removed 
and are not being finalized:
     Sections 402.1(c)(21)(ii) and (iii).
     Sections 402.1 (c)(22)(ii) and (iii).
     Sections 402.105(b)(2)(ii) and (iii).
     Sections 402.105(b)(3)(ii) and (iii).

B. Audit Methodology for Analyzing Records

    To identify potential instances of noncompliance, rather than 
imposing CMPs based upon automated monitoring of all RRE submissions as 
contemplated in the proposed rule, we will utilize the following 
process to audit a randomized sample of recently added beneficiary 
records:
     CMS has determined that, given the time and resources 
necessary to accurately and thoroughly evaluate the accuracy of any 
submitted record, it would be possible to audit a total of 1,000 
records per calendar year across all RRE submissions, divided evenly 
among each calendar quarter (250 individual beneficiary records per 
quarter).
     CMS will evaluate a proportionate number of GHP and NGHP 
records

[[Page 70370]]

based on the pro-rata count of recently added records for both types of 
coverage over the calendar quarter under evaluation. For example, if 
over the calendar quarter being evaluated, CMS received 600,000 GHP 
records and 400,000 NGHP records for a total of 1,000,000 recently 
added beneficiary records, then 60 percent of the 250 records audited 
for that quarter would be GHP records, and 40 percent would be NGHP 
records.
     At the end of each calendar quarter, CMS will randomly 
select the indicated number of records and analyze each selected record 
to determine if it is in compliance with the reporting requirements as 
required by statute and defined herein.
     Noncompliance is defined as any time CMS identifies a new 
beneficiary record that was not reported to CMS timely. Timeliness is 
defined as reporting to CMS within 1 year of the date GHP coverage 
became effective, the date a settlement, judgment, award, or other 
payment determination was made (or the funding of a settlement, 
judgment, award, or other payment, if delayed), or the date when an 
entity's Ongoing Responsibility for Medicals (ORM) became effective. 
Failure to report timely prevents CMS from promptly and accurately 
determining the proper primary payer and taking the appropriate 
actions.
     For GHP entities, for any selected record that is more 
than 1 year (365 calendar days) late, a penalty of $1,000 per day (as 
adjusted) of noncompliance will be imposed as indicated herein.
     For NGHP entities, for any selected record determined to 
be noncompliant, a tiered approach to penalties will be implemented as 
described in detail in section III.C. of this final rule.
     To calculate the penalty imposed against an RRE, CMS will 
multiply the number of audited records found to be noncompliant by the 
number of days that each record was late (in excess of 365 days). The 
product will then be multiplied by the appropriate penalty amount, as 
described previously and below.

C. Tiered Approach for NGHP RREs

    Because we have the statutory authority to adjust the amounts of 
penalties imposed on NGHP RREs, a tiered approach and cap on the total 
amount of penalties applicable to such RREs are being finalized in this 
rule. As explained previously, the statute does not permit us to extend 
this approach to GHP RREs. For any record selected via the random audit 
process described above where the NGHP RRE submitted the information 
more than 1 year after the date of settlement, judgment, award, or 
other payment (including the effective date of the assumption of 
ongoing payment responsibility for medical care); the daily penalty 
will be--
     $250, as adjusted annually under 45 CFR part 102, for each 
calendar day of noncompliance, where the record was reported 1 year or 
more, but less than 2 years after, the required reporting date;
     $500, as adjusted annually under 45 CFR part 102, for each 
calendar day of noncompliance, where the record was reported 2 years or 
more, but less than 3 years after, the required reporting date; or
     $1,000, as adjusted annually under 45 CFR part 102, for 
each calendar day of noncompliance, where the record was reported 3 
years or more after the required reporting date.
    Additionally, the total penalty for any one instance of 
noncompliance by an NGHP RRE for a given record identified by CMS will 
be no greater than $365,000 (as adjusted annually under 45 CFR part 
102).
    While we emphasize that all RREs are obligated to comply with their 
reporting obligations, CMS's approach to enforcement, where a 
randomized sample of records will be reviewed closely (as opposed to an 
automated review of all records), means that smaller entities are 
inherently much less likely to have their records audited for 
compliance. We also encourage entities that are smaller and less 
experienced with Medicare's coordination of benefits processes to take 
advantage of the resources and support available to ensure compliance.

D. Clarification of Good Faith Efforts To Obtain Identifying 
Information

    A key change for the final rule is the expansion of the 
circumstances under which an NGHP entity may avoid CMPs for 
noncompliance caused by failure to obtain identifying information from 
an individual despite a good faith effort to do so.
    In the proposed rule, we proposed providing NGHPs with the ability 
to document ``good faith'' efforts to obtain identifying information of 
reportable individuals. In the final rule, we are expanding this 
exemption. Specifically, as proposed in the proposed rule, NGHPs must 
make a total of three attempts to obtain the required information. At 
least two attempts to obtain the required information from the 
individual and his or her attorney must be by mail or electronic mail, 
but the final rule permits that the third attempt may be via telephone, 
electronic mail, or some other reasonable method.
    Further, the final rule permits that, should an individual or their 
attorney or representative clearly and unambiguously decline to provide 
the information requested, no further attempts by the RRE to obtain the 
required information would be required. This documented refusal to 
provide the required information must be maintained for a minimum of 5 
years, in accordance with the other requirements of this section of the 
rule.
    We understand that NGHP RREs are concerned that attempts to obtain 
beneficiary information, particularly when in an adversarial 
relationship with the beneficiary, may be construed as running afoul of 
certain state and local privacy and anti-harassment laws. If the intent 
and purpose of the RRE's communications with beneficiaries was solely 
to comply with federal requirements, we believe any privacy or anti-
harassment law would be preempted by the reporting requirements set 
forth in the Act.
    All other parameters related to obtaining identifying information, 
including records retention requirements, are being finalized as 
proposed.

IV. Collection of Information Requirements

    This document does not impose any new information collection 
requirements, that is, reporting, recordkeeping, or third-party 
disclosure requirements. The associated information collection 
requirements imposed under mandatory insurer reporting are already 
approved under OMB control number 0938-1074. Consequently, there is no 
need for review by the Office of Management and Budget under the 
authority of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et 
seq.). We did not receive comments on the previous statement and 
therefore are finalizing the language without modification.

V. Regulatory Impact Statement

    We have examined the impact of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993) and 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011) as amended by the Executive Order on Modernizing 
Regulatory Review on April 6, 2023), the Regulatory Flexibility Act 
(RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Act, 
section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 
1995; Pub. L. 104-

[[Page 70371]]

4), Executive Order 13132 on Federalism (August 4, 1999), and the 
Congressional Review Act (CRA) (5 U.S.C. 804(2)).
    Executive Orders 12866 and 13563, as amended by the Executive Order 
on Modernizing Regulatory Review on April 6, 2023, direct agencies to 
assess all costs and benefits of available regulatory alternatives and, 
if regulation is necessary, to select regulatory approaches that 
maximize net benefits (including potential economic, environmental, 
public health and safety effects, distributive impacts, and equity). A 
Regulatory Impact Analysis (RIA) must be prepared for major rules with 
economically significant effects ($200 million or more in any 1 year). 
Modelling of potential penalties likely to be imposed under this rule 
demonstrates that this rule does not reach the economic threshold and 
thus is not considered a major rule.
    Based on CMS workload and resource availability, the sampling 
methodology explained herein would result in a fixed number of 
submitted records to be audited each calendar quarter to determine 
compliance and potential penalty. At present, and absent a notice-and-
comment period to alter such limit, CMS will audit up to 1,000 records 
each year, or up to 250 each calendar quarter. CMS has utilized the 
methodology as described in previous sections, in conjunction with 
utilizing data from the preceding calendar year regarding RRE reporting 
habits and volume, to determine the anticipated penalties that would be 
levied if no other changes in behavior were observed. Although we note 
that CMS believes that publication of the rule will have the intended 
effect of incentivizing increased compliance with reporting 
requirements in an effort to avoid a CMP, we have analyzed the existing 
data with no adjustments for subjective analysis. Assuming the rule had 
been in effect and CMPs could have been imposed based upon reporting 
behavior for calendar year 2022, the maximum penalties imposed would 
have been $86.4 million for GHP entities and $42.4 million for NGHP 
entities, for a total annual CMP amount of $128.8 million, which is 
below the $200 million threshold to be considered an economically 
significant rule. We also note that reporting behavior in this period 
may be skewed towards more untimely reporting, potentially reflecting 
efforts to come into compliance in advance of this rule becoming 
effective. Consequently, we believe this is a worst-case scenario and 
do not expect to collect CMPs totaling $200 million or more in any 
given year, nor do we expect this rule to have any other economic 
effects that meet or exceed that threshold.
    The RFA requires agencies to analyze options for regulatory relief 
of small entities. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
$7.0 million to $35.5 million in any 1 year. Individuals and States are 
not included in the definition of a small entity. We consider a rule to 
have a significant impact on a substantial number of small entities if 
it has at least a 3 percent impact of revenue on at least 5 percent of 
small entities. Affected entities with reporting responsibilities have 
been required to comply with sections 1862(b)(7) and (b)(8) of the Act 
since these provisions were added to the Act in 2007. This rule is 
intended to define how CMPs would be imposed as a consequence of 
noncompliance with these statutory obligations, and thus does not 
present any additional burden beyond the review of the rule. As 
discussed later in this section, the total cost impact of reviewing 
this rule by all 20,855 actively reporting RREs, regardless of size, is 
estimated to be $7,699,249, or $369.18 per entity. As the provisions 
and regulations, the violation of which will result in a CMP under this 
regulation, are already in place, no additional costs to comply with 
this regulation should be realized by any RRE. This regulation merely 
enumerates when and how CMPs will be levied but does not impose any 
additional rules or requirements on any RRE that does not already, at 
present, exist. This falls below the standard definition of 
``significance'' of 3 or more of small entity revenue. As a result, we 
have determined, and the Secretary certifies, that this rule would not 
have a significant economic impact on a substantial number of small 
entities.
    In addition, section 1102(b) of the Act requires us to prepare an 
RIA if a rule may have a significant impact on the operations of a 
substantial number of small rural hospitals. This analysis must conform 
to the provisions of section 604 for the RFA. For purposes of section 
1102(b) of the Act, we define a small rural hospital as a hospital that 
is located outside of a Metropolitan Statistical Area for Medicare 
payment regulations and has fewer than 100 beds. We are not preparing 
an analysis for section 1102(b) of the Act because we have determined, 
and the Secretary certifies, that this rule would not have a 
significant impact on the operations of a substantial number of small 
rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. In 2023, the 
threshold is approximately $177 million. This rule will have no 
consequential effect on state, local, or tribal governments or on the 
private sector. Executive Order 13132 establishes certain requirements 
that an agency must meet when it promulgates a proposed rule (and 
subsequent final rule) that imposes substantial direct requirement 
costs on state and local governments, preempts state law, or otherwise 
has Federalism implications. Since this final rule does not impose any 
costs on state or local governments, the requirements of Executive 
Order 13132 are not applicable.
    We used the current number of actively reporting GHP RREs (1,039) 
and NGHP RREs (19,816) to determine the total number of impacted 
entities (20,855). We recognize that this is a slight overestimate, as 
a single corporate parent may have multiple associated RREs. We welcome 
any comments on the approach in estimating the number of entities which 
will review this rule.
    Using the May 2022 wage information from the U.S. Department of 
Labor Bureau of Labor Statistics for medical and health service 
managers (Code 11-9111), we estimate that the cost of reviewing this 
rule is $123.06 per hour, based on doubling the mean hourly wage of 
$61.53 to include overhead and fringe benefits (see https://www.bls.gov/oes/current/oes119111.htm). We assume that one individual 
associated with each of the 20,855 impacted entities will read the 
rule. Assuming an average reading speed, we estimate that it would take 
approximately 3 hours for the staff to review this rule. For each 
entity that reviews the rule, the estimated cost is $369.18 (3 hours x 
$123.06). Therefore, we estimate that the total cost of reviewing this 
rule is $7,699,249 ($369.18 x 20,855).
    We did not receive additional comments on the regulatory impact 
statement section through the public comment period.
    In accordance with the provisions of Executive Order 12866, this 
rule was reviewed by the Office of Management and Budget.
    Chiquita Brooks-LaSure, Administrator of the Centers for Medicare & 
Medicaid Services, approved this document on September 28, 2023.

[[Page 70372]]

List of Subjects

42 CFR Part 402

    Assessments, Civil money penalties, Exclusions.

45 CFR Part 102

    Administrative practice and procedure, Penalties.

    For the reasons set forth in the preamble, the Centers for Medicare 
& Medicaid Services proposes to amend 42 CFR chapter IV as set forth 
below:

PART 402--CIVIL MONEY PENALTIES, ASSESSMENTS, AND EXCLUSIONS

0
1. The authority citation for part 402 is revised to read as follows:

    Authority:  42 U.S.C. 1302 and 1395hh.


0
2. Section 402.1 is amended--
0
a. In paragraph (c) introductory text by removing the reference 
``(c)(34) of this section'' and adding in its place the reference 
``(c)(35) of this section'';
0
b. By removing paragraph (c)(20);
0
c. By redesignating paragraph (c)(21) as paragraph (c)(20);
0
d. By redesignating paragraphs (c)(22) through (34) as paragraphs 
(c)(23) through (35); and
0
e. Adding new paragraphs (c)(21) and (22).
    The additions read as follows:


Sec.  402.1   Basis and scope.

* * * * *
    (c) * * *
    (21) Section 1862(b)(7)(B)--Except for the situation described in 
paragraphs (c)(21)(ii)(A) and (B) of this section, any entity that has 
a reporting obligation under section 1862(b)(7) of the Act (``reporting 
entity'') that--
    (i) Fails to report any beneficiary record within 1 year of the 
last acceptable reporting date, defined as 365 days from the GHP 
coverage effective date or the Medicare beneficiary's entitlement date, 
whichever is later.
    (ii) A civil money penalty (CMP) is not imposed if--
    (A) The incident of noncompliance is associated with a specific 
reporting policy or procedural change on the part of CMS that has been 
effective for less than 6 months following the implementation of that 
policy or procedural change (or for 1 year, should CMS be unable to 
provide a minimum of 6 months' notice prior to implementing such 
changes).
    (B) The entity complies with any reporting thresholds or any other 
reporting exclusions.
    (22) Section 1862(b)(8)(E)--Except for the situations described in 
paragraph (c)(22)(ii)(A), (B) and (C) of this section, any applicable 
plan that has a reporting obligation under section 1862(b)(8) of the 
Act (``applicable plan''), that--
    (i) Fails to report any beneficiary record within 1 year from the 
date of the settlement, judgment, award, or other payment, or the 
effective date where ongoing payment responsibility for medical care 
has been assumed by the entity.
    (ii) A CMP is not imposed in the following situations:
    (A) An NGHP applicable plan fails to report required information as 
a result of the applicable plan's inability to obtain an individual's 
last name, first name, date of birth, gender, Medicare Beneficiary 
Identifier (MBI), Social Security Number (SSN), or the last 5 digits of 
the SSN, and the applicable plan has made a good faith effort to obtain 
this information by meeting the following:
    (1) Has communicated the need for this information to the 
individual and his or her attorney, or other representative, if 
applicable, or both.
    (2) Has requested the information from the individual and his or 
her attorney, or other representative (if applicable), at least three 
times--
    (i) Once in writing (including electronic mail);
    (ii) Then at least once more by mail; and
    (iii) At least once more by phone or other means of contact in the 
absence of a response to the mailings.
    (3) Has not received a response or has received a written response 
clearly indicating that the individual refuses to provide the needed 
information. Should the applicable plan receive a written response from 
the individual or their attorney or representative that clearly and 
unambiguously declines or refuses to provide any portion of the 
information specified herein, no additional communications with the 
individual or their attorney or other representative are required.
    (4) Has documented its efforts to obtain the MBI or SSN (or the 
last 5 digits of the SSN). This documentation, including any written 
rejection correspondence, must be retained for a minimum of 5 years.
    (B) An NGHP applicable plan complies with any reporting thresholds 
or any other reporting exclusions.
    (C) The incident of noncompliance is associated with a specific 
reporting policy or procedural change on the part of CMS that has been 
effective for less than 6 months following the implementation of that 
policy or procedural change (or for 12 months, should CMS be unable to 
provide a minimum of 6 months' notice prior to implementing such 
changes).
* * * * *

0
3. Section 402.105 is amended by revising paragraph (b)(2) and adding 
paragraph (b)(3) to read as follows:


Sec.  402.105   Amount of penalty.

* * * * *
    (b) * * * *
    (2) For entities with reporting obligations under section 
1862(b)(7) of the Act (``reporting entity''), if a reporting entity 
fails to report any beneficiary record within the specified period from 
the latter of the GHP coverage effective date or the Medicare 
beneficiary's entitlement date. The penalty is--
    (i) Calculated on a daily basis, based on the number of recently 
added beneficiary records reviewed where CMS identifies that the entity 
submitted the required information more than 1 year after the GHP 
coverage effective date for the individual; and
    (ii) $1,000 as adjusted annually under 45 CFR part 102 for each 
calendar day starting the day after 1 year (365 days) from the first 
instance of noncompliance, as defined in paragraph (b)(2)(i) of this 
section.
    (3) For entities with reporting obligations under section 
1862(b)(8) of the Act (``applicable plan'') as follows:
    (i) If an applicable plan fails to report any NGHP beneficiary 
record within the specified period from the date of the settlement, 
judgment, award, or other payment (including the effective date of the 
assumption of ongoing payment responsibility for medical care). The 
penalty is--
    (A) Calculated on a daily basis, based on the number of recently 
added beneficiary records reviewed where CMS identifies that the entity 
submitted the required information more than 1 year after the date of 
settlement, judgment, award, or other payment (including the effective 
date of the assumption of ongoing payment responsibility for medical 
care);
    (B) $250 (as adjusted annually under 45 CFR part 102) for each 
calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of 
this section for each individual for which the required information 
should have been submitted, but was reported more than 1 year but less 
than 2 years after the required reporting date;
    (C) $500 (as adjusted annually under 45 CFR part 102) for each 
calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of 
this section for each individual for which the required information 
should have been

[[Page 70373]]

submitted, but was reported 2 years or more, but less than 3 years, 
after the required reporting date; and
    (D) $1,000 (as adjusted annually under 45 CFR part 102), for each 
calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of 
this section for each individual for which the required information 
should have been submitted, but was reported 3 years or more after the 
required reporting date.
    (ii) The maximum penalty that may be imposed for noncompliance 
associated with any one individual for which the required information 
should have been submitted is $365,000 (as adjusted annually under 45 
CFR part 102).
* * * * *
    For the reasons specified in the preamble, the Department of Health 
and Human Services amends 45 CFR part 102 as specified below:

PART 102--ADJUSTMENT OF CIVIL MONETARY PENALTIES FOR INFLATION

0
4. The authority for part 102 continues to read as follows:

    Authority:  Pub. L. 101-410, Sec. 701 of Pub. L. 114-74, 31 
U.S.C. 3801-3812.



0
5. Section 102.3 is amended in table 1 by adding references for U.S.C. 
1395y(b)(6)(B), 1395y(b)(7)(B)(i), and 1395y(b)(8)(E)(i) in numerical 
order to read as follows:


Sec.  102.3   Penalty adjustment and table.

* * * * *

                      Table 1 to Sec.   102.3--Civil Monetary Penalty Authorities Administered by HHS Agencies and Penalty Amounts
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                                           Date of last
                                                                                                            statutorily    2021 maximum    2022 maximum
          U.S.C. sections                   CFR \1\            HHS agency           Description \2\         established      adjusted        adjusted
                                                                                                          penalty figure    penalty ($)     penalty \4\
                                                                                                                \3\                             ($)
--------------------------------------------------------------------------------------------------------------------------------------------------------
 
                                                                      * * * * * * *
42 U.S.C.:
 
                                                                      * * * * * * *
1395y(b)(6)(B).....................  42 CFR 402.1(c)(20),   CMS               Penalty for any entity                2021           3,484           3,701
                                      402.105(a).                              that knowingly,
                                                                               willfully, and repeatedly
                                                                               fails to complete a claim
                                                                               form relating to the
                                                                               availability of other
                                                                               health benefits in
                                                                               accordance with statute
                                                                               or provides inaccurate
                                                                               information relating to
                                                                               such on the claim form.
1395y(b)(7)(B)(i)..................  42 CFR 402.1(c)(21),   CMS               Penalty for any entity                2021           1,247           1,325
                                      402.105(a).                              serving as insurer, third
                                                                               party administrator, or
                                                                               fiduciary for a group
                                                                               health plan that fails to
                                                                               provide information that
                                                                               identifies situations
                                                                               where the group health
                                                                               plan is or was a primary
                                                                               plan to Medicare to the
                                                                               HHS Secretary.
 
                                                                      * * * * * * *
1395y(b)(8)(E)(i)..................  42 CFR 402.1(c)(22),   CMS               Penalty for any entity                2021           1,247           1,325
                                      402.105(a)(E).                           serving as insurer, third
                                                                               party administrator, or
                                                                               fiduciary for a non-group
                                                                               health plan that fails to
                                                                               provide information that
                                                                               identifies situations
                                                                               where the group health
                                                                               plan is or was a primary
                                                                               plan to Medicare to the
                                                                               HHS Secretary.
 
                                                                      * * * * * * *
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Some HHS components have not promulgated regulations regarding their civil monetary penalty-specific statutory authorities.
\2\ The description is not intended to be a comprehensive explanation of the underlying violation; the statute and corresponding regulation, if
  applicable, should be consulted.
\3\ Statutory or Inflation Act Adjustment.
\4\ The cost of living multiplier for 2018, based on the CPI-U for the month of October 2017, not seasonally adjusted, is 1.02041, as indicated in OMB
  Memorandum M-18-03, ``Implementation of Penalty Inflation Adjustments for 2018, Pursuant to the Federal Civil Penalties Adjustment Act Improvements
  Act of 2015'' (December 15, 2017).
\5\ The cost of living multiplier for 2020, based on the Consumer Price Index for all Urban Consumers (CPI-U) for the month of October 2019, not
  seasonally adjusted, is 1.01764, as indicated in OMB Memorandum M-20-05, ``Implementation of Penalty Inflation Adjustments for 2019, Pursuant to the
  Federal Civil Penalties Adjustment Act Improvements Act of 2015'' (December 16, 2019).


    Dated: October 3, 2023.
Xavier Becerra,
Secretary, Department of Health and Human Services.
[FR Doc. 2023-22282 Filed 10-10-23; 8:45 am]
BILLING CODE 4120-01-P